Reconnaissance
AAT-1001
Agent surface mapping (chat UIs, APIs, copilots, automations)
AAT-1002
Capability probing (tools, plugins, connectors, models)
AAT-1003
RAG target mapping (what sources are indexed; freshness; scope)
AAT-1004
Identity perimeter mapping (IdP, tenants, guests, service principals)
AAT-1005
Approval workflow recon (who approves, thresholds, time windows)
AAT-1006
Telemetry probing (what gets logged; detection/alert behavior)
AAT-1007
Policy/guardrail boundary probing (refusals, tool gating)
AAT-1008
Model fingerprinting (provider, safety mode, tool schemas)
AAT-1009
Search open sources for agent configs (docs, repos, tickets)
AAT-1010
Query public AI services to refine attacks (prompt/voice/deepfake)
Resource Development
AAT-2001
Generate social-engineering content (phish, pretexts, scripts)
AAT-2002
Craft indirect prompt injection payloads (docs, email, web pages)
AAT-2003
Acquire infrastructure (lookalike domains, SaaS tenants, webhook endpoints)
AAT-2004
Stage malicious OAuth app (branding, scopes, redirect URIs)
AAT-2005
Prepare poisoned RAG content (wikis, KBs, tickets, PDFs)
AAT-2006
Create stealth payloads (unicode/homoglyphs, hidden text, stego)
AAT-2007
Develop tool abuse kit (schema confusion, param injection patterns)
AAT-2008
Build rogue agent persona (docs, onboarding, legitimacy signals)
AAT-2009
Acquire compromised accounts/sessions (brokered access)
AAT-2010
Supply-chain positioning (publish poisoned tools/agents/packages)
AAT-2011
Deepfake assets for approvals (voice/video, chat impersonation)
AAT-2012
Adversarial content crafting to trigger unsafe tool routes
Initial Access
AAT-1101
Valid account takeover for agent driving
AAT-1102
AiTM / reverse-proxy phishing to capture sessions
AAT-1103
OAuth consent phishing / malicious app authorization
AAT-1104
Supply-chain compromise of plugin/connector/agent registry
AAT-1105
Indirect prompt injection via ingested email/document/webpage
AAT-1106
Rogue agent invitation into shared workspace/channel
AAT-1107
Shared link delivery with embedded instructions (Drive/SharePoint/Git)
AAT-1108
Trusted relationship abuse (B2B guests, inbound federation foothold)
AAT-1109
Support/ticket channel compromise (instructions as data)
AAT-1110
Drive-by content injection (compromised pages the agent retrieves)
AAT-1111
Device code phishing (token issued via user out-of-band approval)
AAT-1112
Malicious browser extension / workspace add-on to influence agent flows
AI Model Access
AAT-1201
AI inference API access using stolen or mis-scoped credentials
AAT-1202
Full model access via misconfigured hosting / exposed endpoints
AAT-1203
AI-enabled product/service access (attacker uses built-in agent features)
AAT-1204
Model endpoint enumeration (routes, versions, safety modes)
AAT-1205
Prompt crafting to elicit restricted behaviors (jailbreak attempts)
AAT-1206
Exploit model routing (force higher-capability model or toolset)
Execution
AAT-1301
Direct prompt injection (override intended task/goal)
AAT-1302
Indirect/tool-output prompt injection (data treated as instructions)
AAT-1303
Tool parameter injection (attacker-controlled tool arguments)
AAT-1304
Tool selection steering (force powerful tools)
AAT-1305
Function-calling / schema confusion (coerce wrong function)
AAT-1306
Browser automation abuse (agent navigates to attacker flow)
AAT-1307
Unexpected code execution via toolchain (RCE through tools)
AAT-1308
Workflow/CI execution triggered by agent actions (pipelines, serverless)
AAT-1309
UI redressing against approvals (clickjacking, consent misdirection)
AAT-1310
Command generation for operators (agent produces harmful commands)
AAT-1311
Cascading loop induction (retry/fan-out amplifies actions)
AAT-1312
Cross-context instruction smuggling (embed directives in structured data)
Persistence
AAT-1501
Durable OAuth grants / refresh tokens retained
AAT-1502
API keys / service principal credentials planted
AAT-1503
Malicious mail rules / forwarding / inbox persistence
AAT-1504
Webhooks / automation triggers created for re-entry
AAT-1505
Agent configuration tampering (default tools, policies, allowlists)
AAT-1506
Prompt template backdoors (shared system prompts/packs)
AAT-1507
Memory poisoning (long-term instruction persistence)
AAT-1508
Vector DB / RAG poisoning (persist in knowledge base)
AAT-1509
Rogue agents / scheduled autonomous runs (shadow workflows)
AAT-1510
Trusted integration persistence (evil-twin integration remains installed)
AAT-1511
Session persistence via stolen cookies/tokens
AAT-1512
Service desk persistence (rules/macros keep reinfecting content)
Privilege Escalation
AAT-1401
Role escalation via cloud directory (add roles/groups)
AAT-1402
Scope escalation (expand OAuth scopes / app permissions)
AAT-1403
Service principal abuse (app roles, delegated permissions)
AAT-1404
Delegation/impersonation abuse (act-as / on-behalf-of)
AAT-1405
Conditional access/tenant policy modification
AAT-1406
Cross-tenant / federation privilege pivot
AAT-1407
Approval bypass (social engineering of human-in-the-loop)
AAT-1408
Token exchange abuse (convert low privilege to higher privilege token)
AAT-1409
Abuse break-glass / emergency access accounts
AAT-1410
Privilege escalation through tool misconfiguration (admin tools exposed)
Stealth
AAT-1601
Low-and-slow multi-turn manipulation (avoid spikes)
AAT-1602
Living-off-the-land SaaS actions (blend with normal usage)
AAT-1603
Masquerading as legitimate workflow (benign naming/labels)
AAT-1604
Prompt/command obfuscation (unicode, encoding, homoglyphs)
AAT-1605
Hidden directives in documents (white text, comments, stego)
AAT-1606
Delay execution (time-shift tool calls)
AAT-1607
Split actions across identities/tools to reduce correlation
AAT-1608
Data minimization exfil (small periodic exports mimicking routine)
AAT-1609
Use legitimate cloud services as staging/C2 (avoid suspicious domains)
AAT-1610
Manipulate chat history to conceal prior malicious prompts
Defense Impairment
AAT-1701
Disable/modify cloud audit logs / logging sinks
AAT-1702
Disable/modify monitoring integrations (SIEM/SOAR apps)
AAT-1703
Alert suppression (routing rules, muting, notification tamper)
AAT-1704
Modify DLP / egress controls to permit exfil
AAT-1705
Weaken authentication controls (MFA settings, legacy auth enablement)
AAT-1706
Tamper retention settings (shorten log retention)
AAT-1707
Delete/alter agent conversation traces
AAT-1708
Disable security tooling in connected platforms (SaaS security/EDR)
AAT-1709
Subvert trust controls (allowlist attacker app/endpoint)
AAT-1710
Poison detection signals (chaff to overwhelm/raise noise floor)
Credential Access
AAT-1801
Steal web session cookie (browser/session theft)
AAT-1802
Replay cookies (alternate authentication material)
AAT-1803
Steal application access tokens (OAuth/API tokens)
AAT-1804
Credential stuffing against SaaS accounts that drive agents
AAT-1805
Password scraping/harvesting from corp docs/repos
AAT-1806
Prompt-based secret extraction (coax keys from context)
AAT-1807
AiTM interception (credentials + session capture)
AAT-1808
Device code phishing (token minted via user approval)
AAT-1809
API secret theft from CI/CD or configuration repositories
AAT-1810
Credential harvest from agent config (stored tool creds)
AAT-1811
RAG credential harvesting (secrets exposed via retrieval)
Discovery
AAT-1901
Cloud service discovery (apps, dashboards, tenants)
AAT-1902
Account & group discovery (roles, owners, approvers)
AAT-1903
Cloud storage object discovery (drives/buckets/sites)
AAT-1904
Information repository discovery (wiki/tickets/CRM/HR)
AAT-1905
Permission group discovery (who can access what)
AAT-1906
Integration discovery (installed apps, webhooks, automations)
AAT-1907
Secret location discovery (vaults, env vars, pipelines)
AAT-1908
Policy discovery (CA policies, sharing policies, DLP policies)
AAT-1909
Agent configuration discovery (tools enabled, model routing)
AAT-1910
Model artifact discovery (prompts, evals, embeddings, configs)
Lateral Movement
AAT-2101
Taint shared content to propagate indirect prompt injection
AAT-2102
Share poisoned templates/prompts across teams/workspaces
AAT-2103
Invite attacker/rogue agent into shared channels/workspaces
AAT-2104
Pivot via valid accounts across SaaS (SSO sprawl)
AAT-2105
Remote session hijacking across cloud consoles
AAT-2106
Tool-to-tool pivot chains (ticket → repo → CI → cloud)
AAT-2107
Inter-agent message forgery/injection (multi-agent systems)
AAT-2108
Abuse trusted relationship / B2B guest to move tenants
AAT-2109
Lateral tool transfer (agent uploads payloads into other systems)
Collection
AAT-2201
Email collection (mailboxes, threads, attachments)
AAT-2202
Data from cloud storage (Drive/SharePoint/S3/etc.)
AAT-2203
Data from information repositories (wiki/tickets/CRM/HR)
AAT-2204
Data from configuration repositories (Git/IaC/CI variables)
AAT-2205
Conversation history collection (agent transcripts)
AAT-2206
Memory dump/harvest (long-term memory, embeddings)
AAT-2207
Browser/session state capture (screenshots, exports where supported)
AAT-2208
Automated bulk collection via tool loops
AAT-2209
Artifact collection (models, prompts, datasets where accessible)
AI Attack Staging
AAT-3001
Craft adversarial data/instructions to verify exploitability
AAT-3002
Create proxy AI model / shadow agent for testing & evasion
AAT-3003
Generate deepfakes (voice/video) for identity and approvals
AAT-3004
Generate malicious commands/scripts for operator execution
AAT-3005
Verify attack path (dry-run tool calls, safe probes)
AAT-3006
Chaff generation (spam data/prompts to mask signals)
AAT-3007
Retrieval content crafting (false RAG entries, deceptive citations)
Command and Control
AAT-2301
Webhooks as C2 (callbacks to attacker endpoints)
AAT-2302
Chat/IM as C2 (bot channels)
AAT-2303
Email as C2 (automated command mailbox)
AAT-2304
Web service/proxy relays using legitimate SaaS
AAT-2305
Dynamic resolution (rotate endpoints/domains)
AAT-2306
Traffic signaling (low-volume beacons via benign actions)
AAT-2307
Multi-stage channels (stage in one tool, execute in another)
AAT-2308
Agent-to-agent C2 (commands relayed through compromised agents)
Exfiltration
AAT-2401
Transfer data to attacker cloud account (share/sync/export)
AAT-2402
Automated exfiltration via integrations/webhooks
AAT-2403
Exfiltration over web service (POST to attacker)
AAT-2404
Exfiltration via email (external recipients/forwarding)
AAT-2405
Exfiltration via tickets/CRM updates to external parties
AAT-2406
Covert exfil in code artifacts (PRs/commits/releases)
AAT-2407
Scheduled transfer (drip exfil)
AAT-2408
Exfiltration over C2 channel
AAT-2409
LLM data leakage (sensitive responses rendered to attacker)
AAT-2410
Extract system prompt / hidden policies and exfiltrate
Impact
AAT-2501
Financial theft / fraudulent transactions via agent tools
AAT-2502
Data manipulation (silent edits to docs/config/code)
AAT-2503
Data destruction (delete repos/files, wipe)
AAT-2504
Data encrypted for impact (trigger ransomware-like outcomes)
AAT-2505
Service stop / operational disruption (disable pipelines/workflows)
AAT-2506
Denial-of-wallet (cost exhaustion / quota depletion)
AAT-2507
Erode integrity (poison KBs/models; degrade decision quality)
AAT-2508
External harms (misinformation, unsafe actions, reputational damage)
AAT-2509
Inhibit recovery (tamper backups/restore paths)